fix: use session cwd when listing skills

[LucaDiba]

Summary

Fixes skill discovery for ACP sessions whose cwd differs from the codex-acp process cwd.

Previously, session startup refreshed skills with the correct session cwd, but available command publication and /skills later called skills/list with no params. Codex app-server then defaulted back to the adapter process cwd, so repo-local skills from the active ACP session workspace were missing and unrelated repo skills could appear instead.

This changes command skill listing to pass the active session roots:

• sessionState.cwd
• sessionState.additionalDirectories

Fixes #250

Changes

• Pass SessionState into available command publication.
• Use session-scoped skills/list params for:
  • available_commands_update
  • /skills
• Add a portable e2e regression test that creates a temporary workspace skill under .agents/skills and verifies:
  • $workspace-skill appears in available commands
  • /skills lists workspace-skill
• Add focused unit assertions that skill command publication calls listSkills with the session cwd and additional directories.

Verification

• npm run typecheck
• npm run test
• Ran the new e2e test locally through an alternate Codex wrapper to verify the ACP path end-to-end.

[benbrandt]

Thank you!